Skip to content

Full coverage of ECS by ecs@mappings when date_detection is disabled#112444

Merged
eyalkoren merged 6 commits intoelastic:mainfrom
eyalkoren:ecs-mappings-date-fields
Sep 9, 2024
Merged

Full coverage of ECS by ecs@mappings when date_detection is disabled#112444
eyalkoren merged 6 commits intoelastic:mainfrom
eyalkoren:ecs-mappings-date-fields

Conversation

@eyalkoren
Copy link
Copy Markdown
Contributor

Fixes #112398

The new test that I added highlighted something that I think is unexpected - it seems that automatic date detection is applied BEFORE all dynamic templates are matched to the incoming fields.
When setting date_detection: false and using ecs@mappings, some ECS fields get the wrong mapping, but they get the right mapping when date_detection: true. This shouldn't be the case, because the last dynamic template in ecs@mappings acts as a fallback to all string values, mapping then to keyword if they are not matched by any other dynamic template, which is effectively disabling date detection for strings.

@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-storage-engine (Team:StorageEngine)

@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Hi @eyalkoren, I've created a changelog YAML for you.

@eyalkoren eyalkoren requested a review from felixbarny September 4, 2024 05:48
@eyalkoren eyalkoren merged commit 86a3eff into elastic:main Sep 9, 2024
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

💔 Backport failed

Status Branch Result
8.15 Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 112444

@eyalkoren
Copy link
Copy Markdown
Contributor Author

💚 All backports created successfully

Status Branch Result
8.15

Questions ?

Please refer to the Backport tool documentation

eyalkoren added a commit to eyalkoren/elasticsearch that referenced this pull request Sep 9, 2024
…lastic#112444)

(cherry picked from commit 86a3eff)

# Conflicts:
#	x-pack/plugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java
#	x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java
@eyalkoren eyalkoren deleted the ecs-mappings-date-fields branch September 9, 2024 15:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ecs@mappings: support all date fields when date_detection is disabled

3 participants